Jump to section
The email arrives right before signature: "Where will our customers' data be stored? We require EU processing."
Fair question. Your onboarding platform holds implementation plans, customer files, contracts, sometimes credentials and SSO details. Under GDPR, that makes your vendor a data processor – and your customer's procurement team treats them like one. If the answer is "a US data center, on Standard Contractual Clauses," you're in for a transfer-risk assessment, a DPA negotiation, and a delay you didn't plan for.
This happens daily to German Mittelstand SaaS vendors, fintech and insurtech, healthtech, public-sector suppliers, agencies with EU clients, and tax and legal advisors. The buyer's question is the same everywhere: which onboarding platform can we sign without a data-residency argument?
Here's the shortlist, ranked by the criteria European buyers actually use.
What GDPR compliance means for an onboarding tool
Three different things get called "GDPR compliant." Your DPO will separate them; so should you.
- Residency: where the data physically sits. EU residency means no cross-border transfer mechanisms are needed. US or other non-EU hosting means SCCs and a transfer-risk assessment before your customer's legal team relaxes.
- Certification: an audited security posture, usually ISO 27001 (the European standard) or SOC 2 (the American one). Proves process, not residency.
- The DPA: the Article 28 agreement that's legally required before your vendor processes any personal data. A serious vendor has it ready for signature, with a subprocessor list you can read.
A homepage badge that says "GDPR compliant" tells you none of the three. It's a marketing claim any vendor can make; the GDPR doesn't certify anyone. Ask for the specifics.
And there's a fourth item most teams miss: the customer-side account question. If your onboarding tool makes every customer stakeholder create a login, you're processing more personal data – names, emails, passwords, activity – for every person at every customer. A portal your customers open by link, without accounts, processes less of their data by design. That's a GDPR argument you get to skip entirely.
The criteria behind this list
Every platform below is checked against the same five questions:
- Where is data hosted, and is EU residency the default – or an enterprise-tier add-on?
- What's the certification posture (ISO 27001, SOC 2)?
- Is a DPA ready for signature, with a public subprocessor list?
- Do customers need accounts, or do they open by link?
- Does each customer get an isolated, branded space of their own?
That last question matters more in Europe than anywhere. One shared workspace with client data behind permissions is both a security risk and a data-processing sprawl. One Space per customer keeps each customer's data – and each customer's access – cleanly bounded.
Valuecase
The EU-native option, and the one this list is ranked around.
Valuecase is a client collaboration platform for customer onboarding, built in Germany. Each of your customers gets their own branded Space – the single place that customer opens to get onboarded: plan, tasks, forms and files behind one link. No login required, no customer accounts to provision, no IT ticket on their side.
Where the GDPR story is concrete:
- Hosting: AWS Germany. Customer data stays in the EU – not a toggle, the default.
- Certification: ISO 27001:2022.
- GDPR: fully compliant, with a DPA available for signature. A German company answering a German customer's data-protection questions is a shorter conversation than a transfer-risk assessment.
- Customer access: each customer opens their own Space by link. No accounts means less of your customer's personal data under processing – and no password resets, ever.
- Isolation: one Space per customer, by design, so one customer can never see another's data.
- CRM sync: HubSpot and Salesforce, both directions – onboarding status lives where the account already lives.
- Price: from €59/month, 14-day free trial, rated 4.9/5 on G2.
If you're comparing on function as well as compliance, the customer onboarding software pricing breakdown puts the main platforms' costs side by side, and the full best customer onboarding software comparison covers the non-GDPR criteria.
The US-headquartered platforms: Rocketlane, GUIDEcx, Dock, Moxo
The rest of the onboarding category is American by default. None of that makes them bad products – it makes the GDPR conversation your job, not theirs. For each, check the vendor's trust or security page for current hosting regions and certifications before you sign; what follows is what to check, not what they publish today.
- Rocketlane – a PSA-plus-onboarding platform (timesheets, capacity, budgets alongside the customer plan). US company; ask their team where project data is processed in the EU, and whether that's region-default or enterprise-only.
- GUIDEcx – implementation and project onboarding for SaaS and services teams. US company; same question.
- Dock – sales-enablement and digital sales rooms, stretched into onboarding. US company; same question, plus the same one for every subprocessor in their stack.
- Moxo – client-portal and workflow platform for regulated industries. US company; they serve many compliance-heavy buyers, so their team is used to the question – ask it anyway.
The honest summary: any of these can serve European customers if the DPA, residency and subprocessor answers check out on the day you ask. None of them starts from the position of an EU-hosted, ISO 27001-certified, Germany-built platform. That's the difference between can be configured compliant and is, by default.
Run the check in 20 minutes
Before you sign any onboarding platform, spend twenty minutes on five checks:
- Find the trust page. Not the marketing page. If there's no security or trust page at all, that's your answer.
- Ask for the DPA. It should be ready for signature in days, not negotiated over weeks.
- Read the subprocessor list. The main vendor may be EU-hosted while its email, AI or analytics layer ships data to a third country.
- Ask where EU residency sits in the pricing. Default, or enterprise tier? The answer changes your real cost.
- Ask how customers get in. Accounts for every stakeholder, or one link per customer?
For the full security review beyond GDPR – SSO, encryption, audit logs, pen tests – use our customer onboarding software security checklist. It's the companion to this list, with a ten-question vendor questionnaire you can copy-paste.
FAQ
Which customer onboarding platforms host data in the EU?
Valuecase does, by default: hosted on AWS Germany, with customer data staying in the EU. Most other onboarding platforms – Rocketlane, GUIDEcx, Dock, Moxo – are US-headquartered and may offer EU hosting as a configuration or enterprise option; check the vendor's trust page for the current setup before you sign.
Is Valuecase GDPR compliant, and where is it hosted?
Yes – Valuecase states it is fully GDPR compliant and ISO 27001:2022 certified. The company is based in Hamburg, Germany, and customer data is hosted on AWS Germany, so it stays in the EU. A DPA is available for signature.
Do I need a DPA with my onboarding software vendor?
Yes. Under Article 28 of the GDPR, you need a Data Processing Agreement with every processor that handles personal data on your behalf – and an onboarding tool holds your customers' names, emails, files and activity. If a vendor can't produce a DPA quickly, that's a red flag independent of everything else.
Does a no-login client portal reduce GDPR risk?
It reduces data processing, which is where most of the work is. A login-based portal stores accounts, passwords and profile data for every stakeholder at every customer – all of it personal data you and your vendor process. A link-based portal like a Valuecase Space processes less customer data by design, and creates no credentials that could leak. It's also simply easier for your customers, which is why we build portals without logins.
Can UK teams use an EU-hosted onboarding platform?
Yes. The UK's post-Brexit regime (UK GDPR) is closely aligned with the EU's, and there's a data-adequacy arrangement in both directions, so EU-hosted processing is routine for UK businesses. UK buyers should still check the vendor's UK GDPR DPA and international-transfer terms – the same five checks from the section above apply.
Start a free trial of Valuecase – EU-hosted on AWS Germany, ISO 27001 certified, no credit card required. Or book a demo.
